// Security Advisory Triage
Backstage TechDocs RCE via markdown_extensions in mkdocs.yml
GitHub advisories — npm · published 2026-10-07 23:09 UTC
WHAT CHANGEDGitHub published GHSA-4488-j8vj-vqqv on 2026-10-07 for @backstage/plugin-techdocs-node: remote code execution through crafted markdown_extensions in TechDocs mkdocs.yml configuration files. CVE-2026-106510, severity high. Patched in version 1.15.4.
WHY IT MATTERSAn attacker who can commit a malicious mkdocs.yml to a repository processed by TechDocs can execute arbitrary code on the Backstage server. TechDocs runs at build time in the platform infrastructure, not in user browsers, so this is server-side execution with the service account's privileges.
WHAT TO DOUpdate @backstage/plugin-techdocs-node to 1.15.4 or later. If you cannot update immediately, audit mkdocs.yml files in repositories connected to TechDocs for unexpected markdown_extensions entries and restrict write access to those files.
Model-reported confidence 95% (not measured accuracy)
Primary source ↗
written by anthropic/claude-sonnet-4.5
Show the reasoning — raw diff, triage verdict, confidence
RAW DIFF
+ghsa_id: GHSA-4488-j8vj-vqqv +summary: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml +severity: high +published_at: 2026-10-07T18:03:22Z +cve_id: CVE-2026-106510 +vulnerabilities[].package.name: @backstage/plugin-techdocs-node +vulnerabilities[].first_patched_version: 1.15.4
HOW IT WAS JUDGED
Triage signals below are model-reported assertions, preserved verbatim; they are not independent arithmetic verification.
| triage verdict | MATERIAL at 0.92, needed 0.5 |
|---|---|
| triage reasoning | RCE in Backstage TechDocs plugin affects infrastructure platforms and CI/CD tooling that companies run. |
| signals | known exploitation pattern: RCE via config injection · Backstage is a platform/infrastructure tool in dependency trees · plugin-techdocs-node is a runtime package, not consumer software · first_patched_version present: 1.15.4 · high severity with concrete attack vector |
| suppression | — |
| triage model | anthropic/claude-haiku-4.5 ($0.00000) |
| writer model | anthropic/claude-sonnet-4.5 ($0.00000) |